Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/bybren-llc/safe-agentic-workflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/bybren-llc/safe-agentic-workflow/13-testing)<a href="https://agentmods.dev/rules/bybren-llc/safe-agentic-workflow/13-testing"><img src="https://agentmods.dev/badge/rules/bybren-llc/safe-agentic-workflow/13-testing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/bybren-llc/safe-agentic-workflow/13-testing"><img src="https://agentmods.dev/badge/rules/bybren-llc/safe-agentic-workflow/13-testing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00636 |
| Opus 5.5 | $0.00000 | $0.00254 |
| Sonnet 5.5 | $0.00000 | $0.00127 |
| Haiku 4.5 | $0.00000 | $0.00064 |
Grade A, and why
13-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 109 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Testing Rules
These rules apply when writing or modifying tests.
Testing Stack
- Unit/Integration: pytest with pytest-asyncio
- E2E: Docker-based framework (
docker-compose.test.yml) - Coverage: pytest-cov
Test Organization
tests/
unit/ # Fast, isolated unit tests
integration/ # API and database integration tests
e2e/ # End-to-end tests (Docker required)
Running Tests
# Unit tests
pytest tests/unit/
# Integration tests
pytest tests/integration/
# E2E tests
pytest tests/e2e/
# or: make test-e2e
# All tests
pytest tests/ -v
# Full CI validation
{{CI_VALIDATE_COMMAND}}
Test Patterns
API Integration Tests
See patterns_library/testing/api-integration-test.md for the full pattern.
Key points:
- Mock authentication for isolated testing
- Verify RLS context is used (no direct ORM calls)
- Test both success and error paths
- Test authentication failures (401)
- Test authorization failures (403)
- Test input validation errors (422)
E2E Tests
See patterns_library/testing/e2e-user-flow.md for the full pattern.
Key points:
- Use
docker-compose.test.ymlfor infrastructure - Test complete user journeys
- Include login/auth setup in fixtures
- Clean up test data after each run
Writing Good Tests
- Independent: Tests must not depend on execution order
- Repeatable: Same result every time, no flaky tests
- Clear naming:
test_<what>_<condition>_<expected> - Arrange-Act-Assert: Follow the AAA pattern
- Edge cases: Cover boundary conditions, empty states, error paths
- RLS isolation: Verify user A cannot access user B's data
Coverage Requirements
- Business logic: Aim for high coverage
- API endpoints: All routes should have integration tests
- Security paths: Authentication and authorization MUST be tested
- Error handling: All error responses MUST be tested
Acceptance Criteria Verification
When testing a spec, map each acceptance criterion to at least one test:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 109 lines · 0 tokens per session scan A 32f243112b48
13-testing is a cursor rule published in the GitHub repository bybren-llc/safe-agentic-workflow (423 stars, last pushed 2mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 636 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other cursor rules, from other repositories
test-engineer
Test Engineer agent.
hatch3r-testing
Coverage thresholds, mocking strategy, property-based testing, mutation-score targets, flaky test quarantine, and snapshot test discipline.
go-test
Rules for writing and modifying test files (test.go) in go-crypto-wallet.
do-runner
Use the following runners.
issues-tests
Backend test conventions — QuarkusTest, REST Assured, Given, ArchUnit.
flutter-testing-rules
Specifies testing guidelines for Flutter projects, covering unit, widget, and integration tests.